Secure Your Secrets: Encrypting Values with Spring Cloud Config

In the world of microservices, Spring Cloud Config provides a centralized way to manage externalized configurations for your applications. But what about sensitive data like database passwords or API keys? That’s where encryption comes in. This blog post will guide you through the process of encrypting your sensitive values using Spring Cloud Config.

Why Encrypt?

Storing sensitive data in plain text within your configuration files is a major security risk. Encryption ensures that even if your configuration repository is compromised, the sensitive information remains protected.

Steps to Enable Encryption:

1. Set Up Your Config Server:

   • Add the spring-cloud-config-server dependency to your project.

   • Configure your server to point to your configuration repository (e.g., Git).

   • Enable encryption by setting the encrypt.enabled property to true in your application.properties or application.yml file.

     encrypt:
       enabled: true
     

2. Choose an Encryption Method:

   • Symmetric Encryption: Uses a single secret key for both encryption and decryption. This is simpler to set up but requires securely managing the key. You can set the key using the encrypt.key property.

     encrypt.key: your-secret-key
     

   • Asymmetric Encryption: Uses a public key for encryption and a private key for decryption. This offers better security but is more complex to manage. Here’s how to set it up:

     • Generate a Key Pair: Use the keytool command-line utility to generate an RSA key pair.

       keytool -genkeypair -alias config-server -keyalg RSA -keystore config-server.jks -storepass password
       

       This command generates a keystore file named config-server.jks with the alias config-server secured by the password “password”. You’ll be prompted to provide additional information for the key pair.

     • Configure the Config Server: In your application.properties or application.yml file, specify the keystore location, alias, and passwords.

       encrypt:
         keyStore:
           location: config-server.jks 
           password: password
           alias: config-server
           secret: password 
       

3. Encrypt Your Values:

   • Using the Config Server Endpoints:
     • Send a POST request to the /encrypt endpoint of your config server with the value you want to encrypt in the request body.
     • The response will contain the encrypted value.
   • Using the spring CLI:
     • Use the spring encrypt command to encrypt values from your command line. You can specify the keystore details here as well.

4. Store Encrypted Values:

   • Replace the plain text values in your configuration files with the encrypted values. Prefix the encrypted values with {cipher}.

     spring:
       datasource:
         password: '{cipher}encrypted-password'
     

5. Access Encrypted Values in Your Applications:

   • Add the spring-cloud-config-client dependency to your client applications.
   • The config client will automatically decrypt the values when fetching them from the config server.

Example:

Let’s say you have a database password in your application.yml file:

spring:
  datasource:
    password: mysecretpassword

1. Encrypt the password (using the /encrypt endpoint):

   curl -X POST localhost:8888/encrypt -d mysecretpassword
   

   This will return the encrypted value:

   {cipher}6b...encrypted-value...8f
   

2. Update your application.yml:

   spring:
     datasource:
       password: '{cipher}6b...encrypted-value...8f'
   

Now, your client application will receive the decrypted password when it fetches the configuration from the config server.

Security Best Practices:

• Strong Keys: Use strong and unique keys for encryption.
• Key Management: Securely store and manage your encryption keys. Consider using a dedicated key management solution, especially for production environments.
• Regular Key Rotation: Rotate your keys periodically to enhance security.

By following these steps, you can leverage Spring Cloud Config’s encryption capabilities to secure your sensitive data and build more robust and secure microservices.